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IN THE CLAIMS 



This listing of claims will replace all prior versions and listings of claims 
in the application: 

1 . (Original) A method for recognizing and flagging a data item used by 
one or more application programs as falling within the scope of a rule but anomalous 
when compared with other data items falling within the scope of the rule, the method 



comprising: 



determining a collection to which the data item belongs as defined by the 



rule; 



calculating statistics for the other data items in the collection; 
identifying whether the data item is an anomalous data item based on the 



statistical calculations; and 



flagging the data item as an anomalous data item if the data item is 



identified as an anomalous data item. 



2. (Original) The method of claim 1 wherein calculating comprises 
calculating a mean data item size and standard deviation for the other data items in the 



collection. 



3. (Original) The method of claim 1 wherein calculating comprises 



calculating a mean interval between data items and standard deviation for the other data 
items in the collection. 

4. (Original) The method of claim 1 wherein calculating comprises 
calculating a mean data item arrival time and standard deviation for the other data items 
in the collection. 
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5. (Original) The method of claim 1 wherein calculating comprises: 
calculating a presence or absence of keywords for the other data items in 

the collection; and 

identifying whether the data item is an anomalous data item based on the 
presence or absence of keywords. 

6. (Original) The method of claim 1 wherein calculating statistics for the 
other data items in the collection is performed in real time. 

* 

7. (Original) The method of claim 1 wherein the step of calculating 
statistics for the other data items in the collection is performed periodically. 

8. (Original) The method of claim 1 wherein identifying comprises 
determining whether the data items falls outside a number of standard deviations from the 
statistical calculations. 

9. (Original) The method of claim 8 comprising setting the number of 
standard deviations to a value set by a user. 

10. (Original) Computer readable media comprising program code, the 
program code instructing a programmable computer to execute a method for recognizing 
and flagging a data item used by one or more application programs as falling within the 
scope of a rule but anomalous when compared with other data items falling within the 
scope of the rule, the method comprising: 

determining a collection to which the data item belongs as defined the 

rule; 

calculating statistics for the other data items in the collection; 
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identifying whether the data item is an anomalous data item based on the 
statistical calculations; and 

flagging the data item as an anomalous data item if the data item is 
identified as an anomalous data item. 

1 1 . (Amended) The computer readable media of claim 1 0 comprising a 
method for recognizing and flagging a data item used by one or more application 
programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule wherein calculating comprises calculating a 
mean data item size and standard deviation for the other data items sin the collection. 

12. (Original) The computer readable media of claim 10 comprising a 
method for recognizing and flagging a data item used by one or more application 
programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule wherein calculating comprises calculating a 
mean interval between data items and standard deviation for the other data items in the 
collection. 

1 3 . (Original) The computer readable media of claim 1 0 comprising a 
method for recognizing and flagging a data item used by one or more application 
programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule wherein calculating comprises calculating a 
mean data item arrival time and standard deviation for the other data items in the 
collection . 

14. (Original) The computer readable media of claim 10 comprising a 
method for recognizing and flagging a data item used by one or more application 
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programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule wherein calculating comprises: 

calculating a presence or absence of keywords for other data items in the 

collection; and 

identifying whether the data item is an anomalous data item based on the 
presence or absence of keywords. 

15. (Original) The computer readable media of claim 10 comprising a 
method for recognizing and flagging a data item used by one or more application 
programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule wherein calculating statistics for other data 
items in the collection is performed in real time. 

16. (Original) The computer readable media of claim 10 comprising a 
method for recognizing and flagging a data item used by one or more application 
programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule wherein calculating statistics for other data 
items in the collection is performed periodically. 

17. (Original) The computer readable media of claim 10 comprising a 
method for recognizing and flagging a data item used by one or more application 
programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule wherein identifying comprises determining 

* 

whether the data item falls outside a number of standard deviations from the statistical 
calculations. 
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18. (Original) The computer readable media of claim 17 comprising a 
method for recognizing and flagging a data item used by one or more application 
programs as falling within the scope of a rule but anomalous when compared with other 
data items falling within the scope of the rule comprising setting the number of standard 
deviations to a value set by a user. 
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